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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment to 
the Inspector General Act of 1978. This is one of a series of audit, inspection, and special 
reports prepared as part of our oversight responsibilities to promote economy, efficiency, 
and effectiveness within the department. 

This report presents the results of the audit of the Federal Emergency Management 
Agency's internal controls governing disaster acquisitions. We contracted with the 
independent public accounting firm of Urbach Kahn & Werlin LLP (UKW) to perform the 
audit. The contract required that UKW perform its audit according to generally accepted 
government auditing standards. UKW identified six areas where internal controls could be 
strengthened. 

UKW is responsible for the attached report dated January 28, 2009, and the conclusions 
expressed in the report. 

The recommendations herein have been developed to the best knowledge available to our 
contractor and have been discussed in draft with those responsible for implementation. We 
trust that this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all who contributed to the preparation of this report. 




Richard L. Skinner 
Inspector General 




Urbach Kahn & Werlin llp 

CERTIFIED PUBLIC ACCOUNTANTS 



January 28, 2009 



Mr. Matt Jadacki 

Deputy Inspector General for Office of Emergency Management Oversight 
Office of Inspector General 
Department of Homeland Security 
245 Murray Drive, Building 410 
Washington, DC 20528 



Dear Mr. Jadacki: 



Urbach Kahn and Werlin performed an audit of internal controls over the Federal 
Emergency Management Agency disaster acquisition process. The audit objective was to 
determine the extent that internal controls over the disaster acquisition process have 
improved since the 2005 Gulf Coast hurricanes and to identify weaknesses that remain. 
This report presents the results of the audit and includes recommendations the agency can 
implement to enhance the acquisition program's overall success. We performed the audit 
as stipulated in Task Order TPDFIGBPA070009A-0071. 

We appreciate the opportunity to have conducted the audit. Should you have any 
questions, or if we can be of any further assistance, please call me at (571) 227-9500. 




Sincerely, 



Partner 
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Abbreviations 



CO 


Contracting Officer 


COTR 


Contracting Officer's Technical Representative 


DHS 


Department of Homeland Security 


FAR 


Federal Acquisition Regulation 


FEMA 


Federal Emergency Management Agency 


FMFIA 


Federal Managers ' Financial Integrity Act of 1982 


FY 


Fiscal Year 


GAO 


Government Accountability Office 


IMAT 


Incident Management Assistance Team 


OAM 


FEMA Office of Acquisition Management 


OMB 


Office of Management and Budget 


OIG 


Office of Inspector General 


UKW 


Urbach Kahn & Werlin LLP 



OIG 



Department of Homeland Security 
Office of Inspector General 

Executive Summary 



Urbach Kahn & Werlin LLP audited the Federal Emergency 
Management Agency's (FEMA) acquisition process to determine the 
extent to which internal controls have improved since the 2005 Gulf 
Coast hurricanes and to identify weaknesses that remain. FEMA has 
begun to establish a control environment over the disaster acquisition 
process. However, additional safeguards to protect assets and prevent 
and detect errors should be implemented. FEMA should: 



Establish an internal control board and assess the adequacy of its 
internal controls annually; 

Hold contracting officers accountable for their contract file 
maintenance responsibilities; 

Implement departmental policy requiring that contracting 
officers report to contracting professionals for technical 
performance elements; 

Hold contracting officer's technical representatives accountable 
for their delegated contract management tasks in performance 
evaluations; 

Determine what audit findings and recommendations the Office 
of Acquisition Management is responsible for and ensure that 
corrective action is taken; and 

Comply with Federal Acquisition Regulation on contract close 
out, so that unused funds can be spent to address future needs. 

FEMA concurred with the recommendations and has begun to address 
some of the weaknesses identified in the report. 
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Background 



Federal program managers are continually seeking ways to better 
achieve agencies' missions and program results. A key factor in 
helping achieve such outcomes is to implement appropriate internal 
controls. Internal controls comprise the plans, methods, and 
procedures that an agency uses to meet missions, goals, and 
objectives, and in doing so (1) support performance-based 
management and (2) help prevent fraud, waste, and abuse. 



Internal Controls 

An integral component of an organization's 
management that provides reasonable assurance that 
the following objectives are being achieved: 

• Effectiveness and efficiency of operations, 

• Reliability of financial reporting, and 

• Compliance with applicable laws and regulations. 

Standards for Internal Control in the Federal Government 
(GAO/AIMD-00-2 1.3.1, November 1999) 



Internal controls, along with monitoring controls to determine their 
effectiveness, help screen out fraud and are the most effective and 
efficient means to do so. Figure 1, below, illustrates the important 
role internal controls play in fraud prevention. 

Figure 1 : Using Internal Controls to Prevent Fraud 



Investigations and 
prosecutions 




Source: UKW, from a U.S. Government Accountability Office figure 



1 INDIVIDUAL DISASTER ASSISTANCE PROGRAMS: Framework for Fraud Prevention, Detection, and 
Prosecution, (GAO-06-954T, July 2006). 
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As programs change and agencies strive to improve operational 
processes, they must continually assess and update internal controls as 
necessary to ensure effectiveness. For example, in response to lessons 
learned from the 2005 Gulf Coast hurricanes, FEMA has: 

• Restructured the Chief Procurement Office; 

• Created the Office of Acquisition Management (OAM); 

• Increased the number of prepositioned contracts to support 
disaster response activities; 

• Established a contracting officer's technical representative 
(COTR) training program; 

• Developed a strategy map and scorecard to guide its internal 
operations; and 

• Identified initiatives for strengthening the internal controls of 
acquisition operations. 

However, much work remains to be done. FEMA has yet to 
implement hundreds of recommendations that would result in more 
effective, efficient, and economical operations. 3 Government 
internal control standards, 4 which define the minimum level of 
acceptable quality for internal controls, prescribe that internal control 
monitoring should ensure that audit findings are promptly resolved. 



Results of Audit 

Improving FEMA Internal Controls 

In fiscal year (FY) 2007, FEMA could not provide reasonable assurance of 
the effectiveness of its internal controls. FEMA has yet to implement the 
Federal Managers ' Financial Integrity Act of 1982 (FMFIA) and a number 
of key corrective actions. Additionally, FEMA does not yet have formal 
processes in place to provide oversight of internal control improvements, 



2 In January 2009, OAM was renamed the Acquisition Management Division as part of a FEMA Management 
Directorate realignment. See Appendix C for updated organization chart. 

3 Status Report on Open Recommendations to DHS Components (OIG-08-27, February 2008). 

4 Standards for Internal Control in the Federal Government (GAO/AIMD-00-2 1.3.1, November 1999). 
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including a FEMA-wide accountability structure for monitoring ongoing 
internal control activities. 

Office of Management and Budget (OMB) Circular A- 123 and the statute it 
implements, FMFIA, are at the heart of federal requirements to improve 
internal controls. The circular defines 
management's responsibility for internal 
controls and provides guidance on 
improving the accountability and 
effectiveness of operations by 
establishing, assessing, correcting, and 
reporting on internal controls. 
Management is responsible for setting 
the "Tone at the Top," or the ethical 
atmosphere created in the workplace. 
By not implementing FMFIA and not 
taking timely corrective actions, 
FEMA's management has not set the 
"Tone at the Top" that is critical to strong internal controls. 

FMFIA requires managers to examine internal controls annually to 
determine how well they are performing, how they may be improved, and 
the degree to which they help identify and address major risks for fraud, 
waste, abuse, and mismanagement. FEMA has not assessed internal 
controls annually, nor has it established an internal control review board to 
formally oversee internal control improvements. OMB Circular A- 123 
requires agencies to integrate internal controls into their systems to direct 
and guide operations and encourages agencies to establish a senior 
management council or internal control board to address management 
accountability and related issues within the broader context of agency 
operations. 

FEMA offices, including OAM, have not performed required internal 
control reviews. The Acting Chief Financial Officer said, "We are not as far 
along as we need to be" with implementing Circular A- 123. Office of the 
Chief Financial Officer officials said that key staff vacancies and the 
catastrophic nature of the 2005 hurricane season caused delays in 
implementing the circular. FEMA has written a draft internal control board 
charter, but as of September 2008, it had not approved the charter or 
established the board. 




What is "TONE AT THE TOP?" 
"Tone at the Top" refers to the 
ethical atmosphere created in the 
workplace by the organization's 
leadership. Employees pay close 
attention to the behavior and 
actions of their bosses, and they 
follow their lead. In short, 
employees will do what they 
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The draft internal control board charter shows the Chief Financial Officer as 
the council chair. To demonstrate management's commitment to support a 
healthy internal control 



environment and to bring 
appropriate focus to the 
crosscutting issues affecting 
not only OAM, but also all of 
FEMA, the internal control 
board should be chaired by the 
FEMA Administrator or 
Deputy Administrator. Having 
the chair at a higher level 
would demonstrate 



Senior Management Council Chair 

To ensure senior management 
involvement, many agencies have created 
their own senior management council 
often chaired by the agency's lead 
management official, to address 
management accountability and related 
issues in the broader context of agency 
;rations. 




operatioi 

0MB Circ 



ularA-123 



management s commitment to 
a strong control system. It would also focus attention on acquisition process 
improvement initiatives that contribute to the Administrator's inability to 
provide a positive assurance statement on FEMA internal controls. 



Recommendation: 

We recommend that the Administrator, Federal Emergency 
Management Agency 

Recommendation #1 : Implement the requirements of the Federal 
Managers ' Financial Integrity Act at the office and branch level in 
FEMA and establish an internal control board chaired by either the 
FEMA Administrator or Deputy Administrator. 



Management Comments and Contractor Analysis 

FEMA concurred with the recommendation and said that it would 
provide a detailed corrective action plan in its 90-day response. We 
consider FEMA's planned action responsive to the recommendation. 
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Strengthening Contract Files Oversight 



: 



Effective Internal Controls 

Ensure all transactions and other significant 
events are authorized, approved, and clearly 
ocumented, and the documentation is readily 
vailable for examination. 



The contract file is the record 
of what the government 
bought, how they bought it, 
and how the contractor 
performed. OAM does not 
routinely monitor contracting 
officers' (CO) compliance 
with contract file policies and 
procedures, organization and 
maintenance regulations, and contract closeout requirements. FEMA could 
not locate 27% of the contract files requested for review. Many contract 
files are not organized and are missing key information. 




Standards for Internal Control in the Federal Governn 
<GA 



Contract File Documentation Should - 

Provide a complete background to inform 

decisions at each step of the acquisition process 

Support actions taken 

Provide information for reviews and 

investigations 

Furnish essential facts in the event of litigation 
or congressional inquiries. 




Federal Acquisition 
Regulation (FAR) 
Subpart 4.8 contains the 
requirements for 
establishing, maintaining, 
and disposing of contract 
files. It requires that 
contract file 
documentation be 
sufficient to constitute a 
complete history of the 

acquisition. FAR Subparts 4.802 and 4.803 describe types of contract files 
and examples of records that they should contain, the contract file 
organization requirements, and maintenance and closeout guidance. 
Contract files should contain items such as the following: 

• Purchase request, acquisition planning, and other presolicitation 
requirements; 

• Justifications and approvals; 

• Evidence of the availability of funds; 



• Cost/price proposals; 

• Basis for the acquisition and the award; 
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• Assignment of contract responsibilities, including payment 
responsibilities; 

• Independent government cost estimates; and 

• CO's determination of the contractor's responsibility. 

COs could not find many of the contract files we requested. Figure 2 shows 
that COs could not locate 32 of the 120 contract files we requested (27 %). 
Headquarters' COs could not find 16 of 24 files (67%). Regional and 
disaster field office COs could not find 16 of 96 files (17%). In some 
instances, COs did not provide files until months after they were requested, 
or COs provided files that they created to respond to our request. 



Figure 2: UKW Contract Files Requested and Received from FEMA 
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OAM did not have a standardized approach to documentation and file 
maintenance. COs had access to acquisition file checklists designed for 
various contract types and situations. These checklists appeared to be in line 
with FAR requirements and showed what items to include in the contract 
file. However, COs were not required to use the checklists, and we did not 
find them in most of the files we reviewed. Basic documents were missing 
from the files, and many existing documents did not contain authorizing 
signatures. The missing or unsigned documents included contracts, COTR 
designation letters, FEMA Form 40-1 "Requisition and Commitment for 
Services and Supplies," and FEMA Form 60-1 "Requisition for Supplies, 
Equipment and/or Services." 

Supervisors did not hold COs accountable for maintaining complete, 
organized files, and OAM did not monitor file contents to ensure that they 
were complete and organized. The condition of contract files appeared to 
relate directly to the responsible CO's diligence in file maintenance. 
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At one office, the CO was adamant about the files leaving "a footprint" so 
that anyone could pick up a contract file and know the history of the 
contract. This CO used the FEMA acquisition file checklist (FEMA 
Form 40-13) for every file created in the region and in the disaster response 
field office the CO supported. However, the CO and other FEMA officials 
told us the checklist had been rescinded from FEMA procedures. 

At OAM headquarters, COs found 8 of 24 contract files (33%) we 
requested. The 8 contract files were not consistent in content or structure. 
COs included an acquisition file checklist in only two files. Documentation 
was missing from most of the headquarters contract files. 

Contracting staff turnover contributed to and exacerbated file maintenance 
issues. Frequently, contract files were transferred as a result of personnel 
changes and if the file was not in order at this point, it was difficult if not 
impossible for the newly assigned CO to put the file in order. 

When contract files are disorganized and incomplete, particularly when COs 
change, the incoming CO has no way of knowing what has been done up to 
the point when the file was passed on. Also, not monitoring a CO's 
adherence to contract file organization and maintenance requirements 
exposes FEMA to fraud, waste, and abuse. It is difficult, if not impossible, 
to establish what the contract was for, if appropriate contracting competition 
rules were followed, if the government received a fair price, and if the goods 
or services were properly delivered and paid for. 



Recent FEMA Standard Operating Procedures 

"Labeling and Organizing Official Contract File Folders" 
"Transfer of Contract Files from the Joint Field Office to 
the Appropriate Regional Office" 



In September 
2008, the OAM 
Director issued 
two standard 
operating 
procedures that 
address aspects 

of the contract files management problems. The procedures require FEMA 
COs and contract specialists to create and maintain contract file folders as 
required by the FAR, and to retain files in a central file location during 
periods of inactivity and when completed. The procedures require COs at 
disaster field offices to transfer files, which include a complete acquisition 
history, prior to leaving the field office. 

Both procedures include checklists that reference FAR requirements and 
require contracting staff to identify specific document locations. The 
checklists could serve as a mechanism to hold contracting staff accountable 
for their file management responsibilities. With modification, the 
procedures for transferring files from disaster field offices could be 
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expanded to include all instances when a contract file is transferred from 
one CO to another. For additional information on acquisition policies and 
procedures and acquisition workforce issues, see Challenges Facing 
FEMA 's Acquisition Workforce, OIG-09-1 1, November 2008. 



Recommendations: 

We recommend that the Director, Office of Acquisition 
Management: 

Recommendation #2 : Require that all files transferred from one 
contracting officer to another contracting officer meet criteria 
consistent with policy included in the standard operating procedure 
on joint field office file transfer. 

Recommendation #3 : Require supervisors to monitor contract file 
maintenance and hold contracting officers and contracting specialists 
accountable by including, in the annual performance evaluation 
process, an assessment of their contract file maintenance activities. 

Management Comments and Contractor Analysis 

FEMA concurred with the recommendations and said that it would provide 
a detailed corrective action plan in its 90-day response. We consider 
FEMA's planned action responsive to the recommendations. 

Improving Performance Management of Contracting Officers 

COs who work in regions or in disaster 
operations field offices commonly 
report to and receive performance 
appraisals from supervisors who are 
not certified contracting professionals. 
This is contrary to DHS policy, and 
because the rating official is frequently 
a manager reporting to superiors who 
have program delivery responsibilities, 
it creates a potential conflict-of- 
interest situation for the CO. 



• 



GS-1102 Rating Official 

The Head of Contracting Activity 
shall ensure that all GS-1 102s in 
their organizational element have a 
certified GS-1 102 contracting 
professional designated as the rating 
official of record for GS-1 102 
technical performance factors. 



,t Directive #078U 
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Internal control standards indicate that key duties and responsibilities need 
to be divided or segregated among different people to reduce the risk of 
error or fraud, and that transactions should be authorized and executed only 
by persons acting within the scope of their authority. DHS MD 0781.1, 
Contracting Professional 



(GS-1102) Career 
Information, requires that 
certified contracting 
professionals evaluate the 
technical performance of all 
contracting professionals. 
FEMA has not consistently 
implemented MD 078 1 . 1 
requirements. 



Conflict of Interest 

Any relationship that is or appears to be not in 
the best interest of the organization. . .a conflict 
of interest would prejudice an individual's 
bility to perform his or her duties and 



ad 
re; 



sponsibilities objectively. 



Institute of Internal Auditors 




OAM officials said that they provide technical assistance and guidance to 
regional and disaster response field office contracting staff, but that the 
CO's supervisor, usually a Finance/ Administration Section manager, 
evaluates the CO's performance for all performance factors. In essence, the 
CO's performance evaluation is provided by the "customer," which may 
potentially affect the CO's independence. 

In 2007, the Director of OAM discussed changing regional CO reporting 
responsibilities with regional managers. Regional managers opposed the 
change. 



One regional CO reporting to regional program managers said that although 
he had never been forced to take actions that he did not feel comfortable 
with, sometimes the bosses did not like the decisions the CO had to make 
and did not like it when he called OAM for technical assistance. 



During FY 2007, FEMA began to assemble new national and regional 
response teams, called Incident Management Assistance Teams (IMATs), to 
ensure FEMA's capability to immediately deploy qualified and experienced 
personnel and capabilities in support of any disaster incident response. 
FEMA's IMAT concept of operations places the teams in the FEMA 
Disaster Operations Directorate. Some teams will include a full-time CO 
with a reporting chain similar to regional and disaster field office COs. 

COs are responsible for ensuring that acquisitions take place according to 
federal contracting rules. Having a CO's technical performance and career 
advancement controlled by the customer or a supervisor who is not a 
certified contracting professional increases the risk of fraud, waste, abuse, 
and mismanagement in the FEMA disaster acquisition process. 
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Recommendation: 



We recommend that the Director, Office of Acquisition 
Management: 

Recommendation #4 : Implement policy in compliance with 

Department of Homeland Security Management Directive #0781.1 
and require that all contracting officers have a certified contracting 
professional as their rating official of record for technical 
performance factors. Contracting officers should report to 
headquarters Office of Acquisition Management. 

Management Comments and Contractor Analysis 

FEMA concurred with the recommendation and said that it would provide 
a detailed corrective action plan in its 90-day response. We consider 
FEMA's planned action responsive to the recommendation. 

Improving COTR Performance Feedback 

FEMA COTRs serve an important, 
clearly defined role in the 
acquisition process. In November 
2007, the OAM Director issued 
policy that established COTR 
responsibilities and requirements. 
According to the policy, the 
program office recommends a 
COTR for the contract, and the CO 
appoints the COTR and establishes 
COTR expectations in writing. 
The appointment letter lists the CO' 

COTRs perform their technical acquisition functions under the CO's 
direction, but the FEMA performance management system does not hold 
them accountable for their COTR duties. COTRs frequently work for the 
program office that requested the contract and report to a program office 
supervisor. Often, the COTR function is a collateral duty, and the CO does 
not rate the COTR's contract management performance. 



Common COTR Responsibilitic 

Monitor contractor's performance 
Maintain a file documenting COTR 
actions 

Communicate with contractor regardii 
performance 

Alert CO to contractor deficiency 
Review and approve invoices 



TR's duties and responsibilities. 
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Human capital permeates virtually every effort within an agency, including 
successfully acquiring goods and services, and executing and monitoring 
contracts. Human capital policies and practices, a critical factor in the 
control environment, should include a performance management system that 
provides candid and constructive feedback to help people understand their 
contributions and help the organization achieve its goals. 

With no formal process in place for the CO to provide performance 
feedback to the COTR's supervisor, the COTR's evaluation may not reflect 
contract technical oversight responsibilities. The COTR is not ensured 
credit for contract oversight accomplishments or counseling to address 
performance deficiencies. This could reduce the effectiveness and 
consistency of both the contracting and the evaluation process. OAM said 
that DHS has considered creating a policy to require the COTR's supervisor 
to include the CO's performance feedback in the COTR's annual appraisal. 



Recommendation: 

We recommend that the Administrator, Federal Emergency 
Management Agency: 

Recommendation #5 : Revise the performance management process 
so that the supervisor of record includes the contracting officer's 
written assessment of the contracting officer's technical 
representative's contract management performance in the annual 
performance appraisal. The assessment should address factors listed 
in the designation letter. 

Management Comments and Contractor Analysis 

FEMA concurred with the recommendation and said it would provide a 
detailed corrective action plan in its 90-day response. We consider 
FEMA's planned action responsive to the recommendation. 
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Enhancing Oversight of Recommended Corrective Actions 



FEMA and OAM do not 
effectively track audit 
findings and 

recommendations, and do not 
have an accurate report on 
the status of corrective 
actions relative to those audit 
recommendations. These weaknesses exist because FEMA does not place 
sufficient emphasis on effectively tracking audit results. Consequently, 
there is increased risk of inefficient and ineffective operations, and 
management is not able to provide assurance that issues reported in audits 
are addressed. 



Tracking Audit Recommendations 

Audit follow-up is an integral part of good 
management, and is a shared responsibility of 
agency management officials and auditors. 

ised 



FEMA maintains corrective action plans in separate audit files, but does not 
have an effective automated tracking system to monitor its response to 
GAO, OIG, and other internal studies and evaluations. FEMA uses a 
"spreadsheet approach," which relies on manual input as new audit 
recommendations are issued or changes in the status of corrective actions 
occur. 



FEMA is developing an automated tracking system. We reviewed 
information from the new system on OAM audit recommendations and 
found it to be incomplete and unreliable. OAM does not have a current or 
accurate list of audit recommendations for which it is responsible. Without 
a current, accurate inventory of open recommendations, OAM may not take 
recommended corrective actions to improve the acquisition process. 



Recommendation: 

We recommend that the Director, Office of Acquisition 
Management: 

Recommendation #6 : Determine what audit findings and 
recommendations the Office of Acquisition Management is 
responsible for and ensure that corrective action is taken. 



Management Comments and Contractor Analysis 

FEMA concurred with the recommendation and said that it would provide 
a detailed corrective action plan in its 90-day response. We consider 
FEMA's planned action responsive to the recommendation. 
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Improving Contract Closeout Timeliness 



Help ensu 



Effective Internal Controls 

i ensure that management's directives are 
carried out. Control activities should be 
effective and efficient in accomplishing the 
agency's control objectives. 




As discussed in the preceding 
sections of this report, effective 
internal controls help FEMA to 
better achieve mission and 
program results, including 
compliance with applicable 
laws and regulations. Effective 
internal controls would have 
prompted COs in FEMA's 
regional and disaster operations field offices to adhere to the FAR and 
FEMA guidance governing contract closeouts. These COs did not close out 
contracts within the timeframes prescribed under FAR Subpart 4.804-1 and 
the FEMA Disaster Contracting Desk Guide, resulting in unliquidated 
obligations 5 of more than $5 billion that could be used for other needs. 

COs are required to start the contract closeout process when FEMA has 
received and paid for all the goods and services it purchased. However, 
OAM did not monitor contract closeouts or hold COs accountable. Further, 
missing and incomplete contract files make it difficult to close contracts in a 
timely manner. 

OAM officials agreed that the issue of closing contracts and deobligating 
unused funds was serious, and they have begun to address it. FEMA has 
hired a contractor to assist in closing contracts whose performance periods 
have ended. OAM officials told us that they have deobligated $76 million 
since the contractor began work in 2007. Although this is a sizeable 
amount, given over $5 billion in unliquidated obligations, much work 
remains. 



Recommendations : 

We recommend that the Director, Office of Acquisition 
Management: 

Recommendation #7 : Require each contracting officer to close out 
contract files according to timeframes in the Federal Acquisition 
Regulation and FEMA policy. 



5 An obligation occurs when FEMA signs a contract; an unliquidated obligation is the amount of a financial 
obligation not yet expended (Source: U.S. Department of Agriculture, Departmental Regulation 2230-001, 
Reviews of Unliquidated Obligations, August 22, 2006). 
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Recommendation #8 : Accelerate closeout of eligible contracts so 
that funds are more quickly made available for future use. 



Management Comments and Contractor Analysis 

FEMA concurred with the recommendations and said that it would provide 
a detailed corrective action plan in its 90-day response. With regard to 
recommendation #7, FEMA said that either the Management Directorate's 
Acquisition Management Division personnel, or contractor support, will 
close out contract files. With regard to recommendation #8, FEMA said 
that the Acquisition Management Division is working with the Office of 
the Chief Financial Officer to address the close-out of eligible contracts. 
We consider FEMA's current and planned actions responsive to the 
rec ommendations . 
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Appendix A 

Purpose, Scope, and Methodology 



DHS OIG contracted with UKW to audit internal controls over the 
FEMA acquisition process. The audit objective was to determine 
the extent to which internal controls have improved since the 2005 
Gulf Coast hurricanes and to identify weaknesses that remain. 

We conducted this performance audit according to generally 
accepted government auditing standards {Government Auditing 
Standards, July 2007 revision). Those standards require that we 
plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the 
evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. 

The audit focused on acquisitions from October 2006 through 
July 2008. We reviewed FEMA and OAM records and a 
judgmental sample of contract files selected at headquarters and 
field offices. We performed work at FEMA headquarters in 
Washington, DC; at the Brentwood, Tennessee Joint Field Office; 
the Atlanta, Georgia and Kansas City, Missouri Regional Offices; 
and the New Orleans and Baton Rouge, Louisiana Transitional 
Recovery Offices. We held discussions with FEMA officials 
throughout the audit and discussed audit results with FEMA 
officials on November 5, 2008. 

To establish criteria for this audit, we researched U.S. laws and 
regulations; DHS directives; FEMA policies and guidance; and 
OMB, GAO, and Office of Federal Procurement Policy (OFPP) 
requirements and guidelines applicable to internal control and to 
acquisition activities. We reviewed assessments of the FEMA 
acquisition process prepared by FEMA contractors and prior 
reports and congressional testimony by FEMA, DHS OIG, and 
GAO to identify their findings and recommendations related to 
FEMA's acquisition process. We reviewed information, including 
contract file checklists, contained on the Virtual Acquisition 
Office, an acquisition knowledge management subscription service 
that is available to OAM staff. 
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Appendix B 

Management Comments to the Draft Report 



U.S. Dcpirtmmt of Homeland Security 

Washington, DC 20472 




FEMA 



MEMORANDUM FOR: Matt Jadacki 

Deputy Inspector Genera] 

Office of Emergency Management Oversight 



FROM: 




Acting Director 

Office of Policy & Program Analysis 



SUBJECT'. Comments on OIG Draft Report, Internal Controls in the FEMA Disaster 

Acquisition Process-For Official Use Only (FOUO) 

Thank you for the opportunity to review and comment on the Office of Inspector General's (OIG's) subject 
draft audit report. As FEMA works toward refining its programs, the OIG's independent analysis of program 
performance greatly benefits our ability to continuously improve our activities. 

FEMA concurs with the draft report's eight recommendations. Regarding the recommendation that each 
contracting officer be required to close out contract files according to timeframes in the Federal Acquisition 
Regulation and FEMA policy, while we concur with the recommendation, we note that either the 
Management Directorate's Acquisition Management Division (AMD) personnel, or contractor support, will 
close out contract files. With respect to the last recommendation dealing with accelerating closeout of eligible 
contracts so that funds are more quickly made available for future use, please be aware that the AMD is 
engaging in a concerted effort with the Office of the Chief Financial Officer to address the de-obligation of 
tin -liquidated obligations on exiting contracts and has reached an agreement on the process for accelerating 
the de-obligations and closeout of eligible contracts. In our 90-day letter following the issuance of your final 
report, we will provide a detailed corrective action plan with timeframes for completion of each of the 
report's eight recommendations. 

Thank you again for the opportunity to comment on this draft report and we look forward to working with 
you on other issues as we both strive to make FEMA the nation's Preeminent Emergency Management and 
Preparedness Agency. 



www.fcma.eov 
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Appendix C 

FEMA Acquisition Management Division Organization Chart 
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Source: FEMA 
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Appendix D 

Report Distribution 
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ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4199, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



